Extracted

• • Target
    c9a4108b401520345ccc6d3cb0cedf5ce49994b260e3cd8db23e4f4b59c02666
  • Size 45KB
  • SHA256 c9a4108b401520345ccc6d3cb0cedf5ce49994b260e3cd8db23e4f4b59c02666
  • MD5 8a7e26c1c9d567222aa13ce9975cd44b
  • SHA1 899ce1572fdd441cc01393097fbab61b151f999d
  • SHA512 b9157f96d8df61aabd13fcaf965905bd093135ab85a4b986bbd15e6c53bc0753fb3cef323ed614a58b5e586dfc0f3f24b141ffff34abe05d92f1be7424f0cfb0
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjb6g93iz9Ue6e2TRABDZsx:EufspTf2g2Oa9C3y3bt9SgHTRWdsx
  • TLSH
    T18F232B103BE9C12BF2BE4F78ADF26145867AF2633603D54A1CC451DB5613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2